Week 9, 2025
24 February to 2 March 2025. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,488CVEs publishedin the whole week
- 84CriticalCVSS 9.0 and above
- 430HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-34192
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the…
Product not named
ExploitedCritical9.0 - CVE-2024-49035
Partner.Microsoft.Com Elevation of Privilege Vulnerability
Microsoft · Microsoft Partner Center
ExploitedHigh8.7 - CVE-2017-3066
Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability…
Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier
ExploitedCritical9.8 - CVE-2024-20953
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable…
Oracle Corporation · Agile PLM Framework
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2025-27364
In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation…
MITRE · Caldera
Critical10.0 - CVE-2025-27140
WeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)
LabRedesCefetRJ · WeGIA
Critical10.0 - CVE-2025-1744
Out-of-bounds Write in radare2
radareorg · radare2
Critical10.0 - CVE-2023-25574
JupyterHub's LTI13Authenticator: JWT signature not validated
jupyterhub · ltiauthenticator
Critical10.0 - CVE-2025-25279
Arbitrary file read in Mattermost Boards via import & export board archive
Mattermost · Mattermost
Critical9.9 - CVE-2025-27554
ToDesktop before 2024-10-03, as used by Cursor before 2024-10-03 and other applications, allows remote attackers to execute arbitrary commands on the build…
ToDesktop · ToDesktop
Critical9.9 - CVE-2025-20051
Arbitrary file read via block duplication in Mattermost Boards
Mattermost · Mattermost
Critical9.9 - CVE-2025-1128
Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
Critical9.8 - CVE-2024-53944
An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through…
Product not named
Critical9.8 - CVE-2024-8425
WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload
WP Swings · WooCommerce Ultimate Gift Card
Critical9.8